CWE-1259 · Other weaknesses
Improper Restriction of Security Token Assignment
18CVEs
SortMost likely exploited
18 CVEs with CWE-1259 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-36111KubePi's JWT token validation has a defect1Panel-dev · KubePi · CVSS 6.3 · 2024-07-25 | 6.3 | 8.4% | 2024-07-25 |
| CVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionspterodactyl · panel · CVSS 8.1 · 2026-07-28 | 8.1 | 0.7% | 2026-07-28 |
| CVE-2026-16716Multiple Vulnerabilities in IBM API ConnectIBM · API Connect · CVSS 8.8 · 2026-11-07 | 8.8 | 0.5% | 2026-11-07 |
| CVE-2024-36533Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.No vendor recorded · CVSS 9.8 · 2024-07-24 | 9.8 | 0.5% | 2024-07-24 |
| CVE-2026-58429Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsGitea · Gitea Open Source Git Server · CVSS 4.9 · 2026-08-13 | 4.9 | 0.5% | 2026-08-13 |
| CVE-2026-76413Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account VulnerabilityCisco · Cisco Secure Firewall Management Center (FMC) · CVSS 8.2 · 2026-09-16 | 8.2 | 0.5% | 2026-09-16 |
| CVE-2026-25700Apache Answer: AdminToken not invalidated after admin deactivationApache Software Foundation · Apache Answer · CVSS 7.2 · 2026-06-10 | 7.2 | 0.4% | 2026-06-10 |
| CVE-2025-51306In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session mana…Gatling · Gatling · CVSS 6.5 · 2025-08-06 | 6.5 | 0.4% | 2025-08-06 |
| CVE-2025-50579A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin head…Jc21 · Nginx Proxy Manager · CVSS 5.3 · 2025-08-19 | 5.3 | 0.4% | 2025-08-19 |
| CVE-2025-27955Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information a…Philips · Clinical Collaboration Platform · CVSS 6.5 · 2025-06-02 | 6.5 | 0.4% | 2025-06-02 |
| CVE-2025-56676TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to lo…Titansystems · Zender · CVSS 5.4 · 2025-09-30 | 5.4 | 0.3% | 2025-09-30 |
| CVE-2025-56207A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) project, allows user…No vendor recorded · CVSS 6.5 · 2025-09-30 | 6.5 | 0.3% | 2025-09-30 |
| CVE-2024-4598Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich MediatorWSO2 · WSO2 API Manager · CVSS 6.5 · 2025-09-23 | 6.5 | 0.3% | 2025-09-23 |
| CVE-2026-40264OpenBao's Token Store Allows Cross-Namespace Renewal, Revocationopenbao · openbao · CVSS 2 · 2026-04-21 | 2.0 | 0.3% | 2026-04-21 |
| CVE-2024-41948biscuit-java vulnerable to public key confusion in third party blockbiscuit-auth · biscuit-java · CVSS 3 · 2024-08-01 | 3.0 | 0.3% | 2024-08-01 |
| CVE-2026-117635Gitea admin API public-only token scope bypassGitea · Gitea · CVSS 6.5 · 2026-11-01 | 6.5 | 0.3% | 2026-11-01 |
| CVE-2024-29371In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ra…Jose4j Project · Jose4j · CVSS 7.5 · 2025-12-17 | 7.5 | 0.3% | 2025-12-17 |
| CVE-2024-45448Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidentiality.Huawei · HarmonyOS · CVSS 4.1 · 2024-09-04 | 4.1 | 0.1% | 2024-09-04 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.